Packetforge-ng

Description

The purpose of packetforge-ng is to create encrypted packets that can subsequently be used for injection. You may create various types of packets such as arp requests, UDP, ICMP and custom packets. The most common use is to create ARP requests for subsequent injection.

To create an encrypted packet, you must have a PRGA (pseudo random genration algorithm) file. This is used to encrypt the packet you create. This is typically obtained from aireplay-ngchopchop or fragmentation attacks.

Usage

Usage: packetforge-ng <mode> <options>

Forge options

-p <fctrl> : set frame control word (hex)

-a <bssid> : set Access Point MAC address

-c <dmac> : set Destination MAC address

-h <smac> : set Source MAC address

-j : set FromDS bit

-o : clear ToDS bit

-e : disables WEP encryption

-k <ip[:port]> : set Destination IP [Port]

-l <ip[:port]> : set Source IP [Port] (Dash lowercase letter L)

-t ttl : set Time To Live

-w <file> : write packet to this pcap file

Source options

-r <file> : read packet from this raw file

-y <file> : read PRGA from this file

Modes

--arp : forge an ARP packet (-0)

--udp : forge an UDP packet (-1)

--icmp : forge an ICMP packet (-2)

--null : build a null packet (-3)

--custom : build a custom packet (-9)

Usage Example

Generating an arp request packet

Here is an example of how to generate an arp request packet.

First, obtain a xor file (PRGA) with either the aireplay-ng chopchop or fragmentation method.

-k 192.168.1.100 is the destination IP. IE In an arp it is the “Who has this IP”

-l 192.168.1.1 is the source IP. IE In an arp it is the “Tell this IP”

-y fragment-0124-161129.xor

-w arp-packet

Assuming you are experimenting with your own access point, arp request packet generated above can be decrypted with your own key. So to see that packet we just created can be decrypted:

Enter “airdecap-ng -w <access point encryption key> arp-request”

The results look like this:

Total number of packets read 1
Total number of WEP data packets 1
Total number of WPA data packets 0
Number of plaintext data packets 0
Number of decrypted WEP packets 1
Number of decrypted WPA packets 0

To view the packet that was just decrypted, enter “tcpdump -n -vvv -e -s0 -r arp-request-dec”

By entering “y” above, the packet you created with packetforge-ng is then injected.

Generating a null packet

This option allows you to generate LLC null packets. These are the smallest possible packets and contain no data. The switch “-s” is used to manually set the size of the packet. This a simple way to generate small packets for injection.

Remember that the size value (-s) defines the absolute size of an unencrypted packet, so you need to add 8 bytes to get its final length after encrypting it (4 bytes for iv+idx and 4 bytes for icv). This value also includes the 802.11 header with a length of 24bytes.

Generating a custom packet

If you want to generate a customer packet, first create a packet with the tool of your choice. This could be a specialized tool, a hex editor or even from a previous capture. Then save it as a pcap file. Following this, run the command:

packetforge-ng -9 -r input.cap -y keystream.xor -w output.cap

Where:

-9 means generate a custom packet.

-r input.cap is the input file.

-y keystream.xor is the file containing the PRGA.

-w output.cap is the output file.

When it runs, packetforge-ng will ask you which packet to use and then output the file.

Usage Tips

Most access points really don't care what IPs are used for the arp request. So as a result you can use 255.255.255.255 for source and destination IPs.

Usage Troubleshooting

Including both -j and -o flags

A common mistake people make is to include either or both -j and -o flags and create invalid packets. These flags adjust the FromDS and ToDS flages in the packet generated. Unless you are doing something special and really know what you are doing, don't use them. In general, they are not needed.

Error message "Mode already specified"

This is commonly caused by using the number one (-1) instead of dash lowercase L (-l) in the command.